#18456: HttpRequest.get_full_path does not escape # sign in the url
-------------------------------------+-------------------------------------
Reporter: vlad.shcherbina@… | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage: Design
Has patch: 0 | decision needed
Needs tests: 0 | Needs documentation: 0
Easy pickings: 0 | Patch needs improvement: 0
| UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by aaugustin):
* needs_docs: => 0
* stage: Unreviewed => Design decision needed
* component: Uncategorized => HTTP handling
* needs_tests: => 0
* needs_better_patch: => 0
Comment:
`request.get_full_path()` returns the
[https://docs.djangoproject.com/en/dev/ref/request-
response/#django.http.HttpRequest.get_full_path path with the query
string] (if there is one). The result doesn't have any particular encoding
or escaping applied. The docs would mention it otherwise :)
This is a bit pathological when the path includes a "?". In this case, the
"?" must have been escaped in the original representation of the URL
(written in the HTML or typed in the address bar). Otherwise it would have
been interpreted as the beginning of the query string. However, since
`request.get_full_path()` is just `path + '?' + query string`, you can't
tell the difference between a "?" in the path and the "?" that marks the
beginning of the query string in its output.
"#" is less of a problem. Browsers don't includes fragments (that's the
official name for "anchor") in requests, so if you have a # in the output
of `request.get_full_path()`, it was in the path or the query string. It
can't be the anchor.
To sum up with an example, if the escaped URL is `/%3Ffoo%23bar?baz#quux`,
then `request.get_full_path()` is `/?foo#bar?baz`.
----
So your question boils down to: should `path` be URL-encoded when building
`request.get_full_path()`?
To be honest I'm not sure.
Note that `django.utils.encoding.iri_to_uri()` won't do the job because it
keeps # and ? unchanged.
Related ticket: #11522
--
Ticket URL: <https://code.djangoproject.com/ticket/18456#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/django-updates?hl=en.
